Hello, we have several sites that are running CME 3.2 with 12.3(11)T11 code with no problems. However, at one small site the 2811 router is also running IPSEC over two T1's and we've had to source the VPN tunnel from a loopback to get load-balancing going. Unfortunately it looks like the 12.3(11) code doesn't do a good enough job with CEF to keep the two circuits balanced. When a particular VPN is heavily active we see one of the circuits go way up on utilization while the other stays low. We had this problem at some other VPN sites and when the router was moved to 12.4(3d) code the CEF balancing started working much better. My problem with the CME router site is that I definitely don't want to do anything that forces us to go above CME 3.2. So my question is since I'm using the cme-basic-123-11T file with IOS c2800nm-advipservicesk9-mz.123-11.T11.bin, do those versions have to always match or can the router be bumped up to c2800nm-advipservicesk9-mz.124-xxxxx.bin code without affecting CME 3.2?